Privacy Policy

1. Introduction

James Flow ("we", "us", "our") respects your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information when you use our Chrome extension and related services ("the Service").

2. Data We Collect

Account data: Email address and authentication credentials provided during registration.

User content: Skills (text), Captures (screenshots), AI conversation history, groups, tags, and configurations you create within the Service.

Usage data: Daily AI message count, feature usage metrics, and plan-related information necessary for billing and quota enforcement.

Technical data: Browser type, extension version, and basic error logs for debugging purposes.

3. Data We Do NOT Collect

• We do not collect browsing history or track which websites you visit.
• We do not read or access content on web pages you visit.
• We do not sell, rent, or share your personal data with third parties for advertising purposes.
• We do not use your content to train AI models.

4. How We Use Your Data

• To provide, maintain, and improve the Service.
• To sync your content across devices when cloud sync is active.
• To process AI requests through our native AI or your configured external providers.
• To manage billing, subscriptions, and usage quotas.
• To send essential service communications (account verification, billing, critical updates).

5. Data Storage and Security

Local storage: Your content is stored locally in the browser using IndexedDB. This data remains on your device and is accessible only to you.

Cloud storage: When cloud sync is active, your content is stored in Supabase with Row Level Security (RLS), ensuring that only you can access your own data.

API keys: External provider API keys you configure are stored encrypted. We never transmit your API keys to any party other than the provider you selected.

Infrastructure: Our backend runs on Cloudflare Workers and Supabase, both of which employ industry-standard security practices.

6. Third-Party Services

The Service integrates with the following third parties:

• Supabase: Authentication and cloud data storage.
• Cloudflare: Website hosting, Workers for API proxy, and AI inference.
• Paddle: Payment processing (Merchant of Record). Paddle collects billing information directly; we do not store your credit card details.
• External AI providers (OpenAI, Anthropic, Google, xAI, Moonshot, OpenRouter): Only when you explicitly configure your own API key. Your content is sent to the selected provider for processing according to their respective privacy policies.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your cloud-synced data within 30 days. Local data in IndexedDB is managed by your browser and can be cleared at any time.

8. Your Rights

You have the right to:

• Access your data at any time through the Service interface.
• Export all your data (Skills, Captures, configurations) in JSON format via the Config tab.
• Delete your data by using the reset function or by requesting account deletion.
• Withdraw consent for cloud sync at any time by disabling it in settings.

9. Cookies

The James Flow website uses only essential cookies for authentication and language preference. We do not use tracking cookies, analytics cookies, or advertising cookies.

10. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect data from children under 13.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top reflects the most recent revision.

12. Contact

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at support@jamesflow.com.